search

cyclestreets / cyclescape

Cyclescape - cycle campaign group toolkit
https://www.cyclescape.org/
MIT License
33 stars 15 forks source link

Bump jquery-ui-rails, rails, haml-rails, omniauth, omniauth-facebook and progress_bar #1091

Open dependabot[bot] opened 2 weeks ago

dependabot[bot] commented 2 weeks ago

Bumps jquery-ui-rails, rails, haml-rails, omniauth, omniauth-facebook and progress_bar. These dependencies needed to be updated together. Updates jquery-ui-rails from 5.0.5 to 7.0.0

Changelog

Sourced from jquery-ui-rails's changelog.

7.0.0

  • Update to jQuery UI 1.13.0

6.0.1

  • Fix "define is not defined" issue in core.js

6.0.0

  • Update to jQuery UI 1.12.1
  • The widget files moved. Change e.g. require jquery-ui/sortable to require jquery-ui/widgets/sortable
Commits
  • 413265e Merge pull request #139 from nescalera/jquery-ui-1.13.0
  • 27a942c up gem version to 7.0.0
  • 54cc600 Upgrades jquery-ui to 1.13.0
  • 0b22d46 Merge pull request #121 from Borzik/fix-history
  • c9bdcf6 fix history, this change affected 6.0.0, not 5.0.4
  • 97e9530 Merge pull request #118 from jaredbeck/patch-1
  • 7b1db12 Docs: Mention how the widget files moved in 6.0.0
  • a640214 Merge pull request #116 from alvir/patch-1
  • 8f39b6d Remove /widgets from example for stylesheets in README
  • dcf13e3 Merge pull request #114 from n-rodriguez/master
  • Additional commits viewable in compare view


Updates rails from 6.1.7.8 to 6.1.7.10

Release notes

Sourced from rails's releases.

6.1.7.10

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • Fix NoMethodError in block_format helper

    Michael Leimstaedtner

Action Cable

  • No changes.

Active Storage

  • No changes.

Action Mailbox

  • No changes.

... (truncated)

Commits
  • 86864c2 Preparing for 6.1.7.10 release
  • 78cfd2f Prepare for 6.1.7.10
  • 9cd0b8f Improvements to releaser
  • 77f0d70 Fix NoMethodError in ActionMailer block_format
  • b2fbbfb Preparing for 6.1.7.9 release
  • 534b3c7 Update CHANGELOGs
  • faadb28 Merge pull request #16 from rails/7-0-sec-relase
  • 985f192 Avoid backtracking in ActionMailer block_format
  • 4f4312b ActionText: Avoid backtracing in plain_text_for_blockquote_node
  • fb493be Avoid backtracking in filtered_query_string
  • Additional commits viewable in compare view


Updates haml-rails from 2.0.1 to 2.1.0

Commits
  • 60dca31 Version 2.1.0
  • aa0cde5 Wrong use of protected
  • 587495c Whitespace
  • 9f9a55b Merge pull request #180 from BilalBudhani/haml-6
  • 4d7297f Update haml-rails.gemspec
  • 3692420 đź‘‹ Travis CI
  • 100717b There's a newer version of actions/checkout
  • 4da8568 Newer version first
  • 5df76d3 Currently released jruby does not yet support rails 7
  • c8839db setup-ruby will pick newest stable jruby when simply "jruby" was given
  • Additional commits viewable in compare view


Updates omniauth from 1.9.2 to 2.1.2

Release notes

Sourced from omniauth's releases.

v2.1.0

This release adds Ruby 3.0+ support.

Due to kwarg changes in ruby 3, we have bumped the minimum required version of Rack to 2.2.3, which is where ruby3 support was added.

Releasing as a minor as dependency resolution should fail at install if an application is locked to a rack below new minimum.

Full Changelog: https://github.com/omniauth/omniauth/compare/v2.0.4...v2.1.0

v2.0.4

This release removes unnecessary warning logging when accessing GET routes that are not related to the OmniAuth request path.

Thanks to @​charlie-wasp and @​sponomarev at Evil Martians for the bug find and subsequent PR.

Fix rescuing of application errors when call_app! is used.

As a consequence of the changes that were merged in #689, errors thrown by strategies that utilize other_phase (or more specifically call_app!), would be caught by omniauth, causing headaches for folks looking to have those errors handled by their application. This should allow for errors that come from the app to pass through, while passing errors that come from the authentication phases to the fail! handler.

Resolves #1030

Fix for incorrect order of request_validation_phase in test_mode.

@​jsdalton gave an awesome report of the issue present in test_mode in #1033

The current implementation of mock_call was verifying the token for all requests, regardless of whether the current path is on the omniauth request path. The change was introduced recently in 1b784ff. See #1032 for details.

This creates two problems:

  1. When test mode is on, the authenticity verification logic is run inappropriately against requests where this may not even be wanted.
  2. The behavior varies from actual production behavior, potentially allowing bugs to be introduced by unwary developers.

Note that this bug was only present when OmniAuth was configured for test_mode and using the mock_call phases.

Allow passing rack-protection configuration to default request_validation_phase

This release now properly allows an instance of OmniAuth::AuthenticityTokenProtection (with passed in rack-protection configuration) to be used as the request_validation_phase.

Thanks @​jkowens #1027

If you haven't already read the release notes for v2.0.0, you should do so.

v2.0.0

Version 2.0 of OmniAuth includes some changes that may be breaking depending on how you use OmniAuth in your app.

Many thanks to the folks who contributed in code and discussion for these changes.

OmniAuth now defaults to only POST as the allowed request_phase method.

Hopefully, you were already doing this as a result of the warnings due to CVE-2015-9284.

... (truncated)

Commits
  • 36f46c4 Prep for next release
  • a13cd11 Merge pull request #1122 from nschonni/jruby-hack
  • a0b31ec fix: conditional delegate require Rack/JRuby
  • 79d0c9a Merge pull request #1118 from nschonni/remove-old-conditions
  • c160e48 Merge pull request #1102 from madogiwa0124/update-tesed-ruby-versions
  • b6cc0cc chore: Remove conditions for old (J)Ruby
  • c6e01a6 Merge pull request #1110 from nschonni/dependabot-setup
  • 4e9563f ci: update coverals to v2
  • fa2674c ci: update actions/checkout to v3
  • d050031 chore: add Dependabot for version updates
  • Additional commits viewable in compare view


Updates omniauth-facebook from 6.0.0 to 10.0.0

Release notes

Sourced from omniauth-facebook's releases.

v8.0.0 (access token in profile picture link)

user profile picture link includes access token (#344, @​anklos)

Changelog

Sourced from omniauth-facebook's changelog.

10.0.0 (2024-05-23)

Changes:

  • bumped version of FB Graph API to v19.0

9.0.0 (2021-10-25)

Changes:

  • bumped version of FB Graph API to v5.0

8.0.0 (2020-10-20)

Changes:

7.0.0 (2020-08-03)

Changes:

  • bumped version of FB Graph API to v4.0
Commits


Updates progress_bar from 1.3.0 to 1.3.4

Changelog

Sourced from progress_bar's changelog.

1.3.4

  • Updated dependencies (#63)
  • Relaxed highline gem requirement to allow 3.x (#62, Thanks to @​dgholz)

1.3.3

  • Fixed use of unqualified ::Time that was conflicting with another ProgressBar gem #58. Thanks to harryloewen for the report

1.3.2

  • Added ProgressBar#puts, to be able to print text to the output without interfering with the rendering of the bar output. #56 Thanks to TRex22 for the suggestion in #44.

1.3.1

  • Added support for passing bar options to Enumerable#with_progress extension.
Commits


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/cyclestreets/cyclescape/network/alerts).